Phishing is the attempt to acquire sensitive information such as usernames, passwords, and/or credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social websites, auction websites, banks, online payment processors, or information technology administrators are commonly used to lure the unsuspecting public.
Phishing emails may contain links to websites that are infected with malware. Phishing is typically carried out by email spoofing or instant messaging, and often directs users to enter details at a fake website whose appearance is almost identical to the corresponding legitimate website. Most methods of phishing use some form of technical deception designed to make a link, or uniform resource locator, in an email (and the spoofed website it leads to) appear to belong to the spoofed organization. One strategy for combating phishing is to educate people how to recognize phishing attempts, and how to deal with these attempts. Another popular approach to fighting phishing is to maintain a list of known phishing links and websites and to check links and websites against the list. Specialized spam filters can reduce the number of phishing emails that reach addressee inboxes.
A computer security incident response team may spread knowledge of targeted attacks via emails, text messages, and a computer security incident response team website. Anti-phishing software consists of computer programs that attempt to identify phishing content contained in websites and e-mail. Anti-phishing software may display the real domain name for the website the viewer is visiting, in an attempt to prevent fraudulent websites from masquerading as other legitimate web sites. However, users tend not to check security information, even when it is explicitly displayed to them.